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Why GAO Did This Study 

Search and rescue — one of the 
Coast Guard's oldest missions — 
involves minimizing the loss of life, 
injury, and property damage by 
aiding people and boats in distress. 
The Coast Guard has previously 
reported that its 30-year-old search 
and rescue communication system, 
called the National Distress and 
Response System, has several 
deficiencies and is difficult to 
maintain. Thus, the Coast Guard 
contracted to replace and 
modernize it with a new system, 
called Rescue 21. 

GAO was asked to identify the 
status and plans of the Coast 
Guard's acquisition of Rescue 21 
and the technical and program 
risks associated with Rescue 21. 



What GAO Recommends 



GAO recommends, in part, that the 
Secretary of Homeland Security 
direct the Commandant of the U.S. 
Coast Guard to establish a new 
schedule for critical testing phases 
and initial operating capability and 
ensure that milestones are 
established for completing test 
plans for formal qualification 
testing, system integration testing, 
and operational testing and 
evaluation. 

In commenting on a draft of our 
report, Coast Guard officials 
generally agreed with GAO's 
findings and recommendations and 
provided technical corrections, 
which were incorporated as 
appropriate. 



www.gao.gov/cgi-bin/getrpt7GAO-03-1 111. 

To view the full product, including the scope 
and methodology, click on the link above. 
For more information, contact David A. 
Powner at (202) 512-9286 or 
pownerd@gao.gov. 



What GAO Found 

Rescue 21's original schedule, which called for it to achieve initial operating 
capability by September 2003, has been postponed, and the Coast Guard has 
not yet finalized a new schedule. This postponement was due in part to the 
development of the system taking longer than planned. 

GAO reviewed the Coast Guard's management of three risk areas associated 
with Rescue 21: 

• Test management. Scheduled completion dates for key tests are still 
being determined. These key tests (formal qualification testing, system 
integration testing, and operational testing and evaluation) are 
incremental tests that the Coast Guard is planning to perform before 
reaching initial operating capability. Completion dates are not yet set 
because the Coast Guard decided to postpone initial operating capability 
due to delays in the original test schedule, which resulted in increased 
risks associated with compressing and overlapping key tests (see figure). 
In addition, key deliverables, including test plans, are still outstanding, 
and no scheduled completion dates exist. 

• Requirements management. The Coast Guard has a process in place for 
managing system requirements. 

• Risk management. The Coast Guard has a program in place for 
identifying, prioritizing, and minimizing risks. Two high risks identified 
by the Coast Guard are software development and environmental 
concerns related to the construction of new antenna sites, which may 
delay the implementation of Rescue 21. 
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September 30, 2003 



The Honorable Frank A. LoBiondo 
Chairman 

The Honorable Bob Filner 
Ranking Minority Member 

Subcommittee on Coast Guard and Maritime Transportation 
Committee on Transportation and Infrastructure 
House of Representatives 

The National Distress and Response System is a significant component of 
the United States Coast Guard's search and rescue program. However, 
Coast Guard officials have reported that the 30-year-old system has several 
deficiencies and is difficult to maintain. In September 2002, the Coast 
Guard contracted with General Dynamics Decision Systems (General 
Dynamics) to modernize and replace the National Distress and Response 
System with a system called Rescue 21. As you requested, our objectives 
were to identify the (1) status and plans of the Coast Guard's acquisition of 
Rescue 21 and (2) technical and programmatic risks associated with 
Rescue 21. 

To identify the status and plans for acquiring Rescue 21, we analyzed 
Rescue 21's acquisition strategy and cost and schedule estimates. We also 
compared original Rescue 21 plans with current strategies. To identify the 
technical and programmatic risks associated with Rescue 21, we reviewed 
key Coast Guard acquisition documents, including test plans, requirements 
documents, the risk watch list, and risk mitigation plans. We performed our 
work at the Coast Guard headquarters in Washington, D.C.; the Coast 
Guard group site in Chincoteague, Va.; and General Dynamics in Scottsdale, 
Ariz. We conducted our work from November 2002 through June 2003 in 
accordance with generally accepted government auditing standards. 

On August 13, 2003, we provided your offices with a status briefing on the 
results of this review, which is included as appendix I. The purpose of this 
letter is to provide the published briefing slides to you and to officially 
transmit our recommendations to the Secretary of Homeland Security. 

In brief, we reported that the Coast Guard's original schedule for reaching 
initial operating capability by September 2003 had been postponed and that 
the Coast Guard had not yet finalized a new schedule. The postponement of 
the schedule for reaching initial operating capability was due in part to the 
system's development taking longer than planned. In reviewing the Coast 
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Guard's test management practices, we found that the Coast Guard 
postponed key tests in part because prior schedules showed delay, overlap, 
and compression of tests, which increased the risk that all requirements 
would not be tested. In addition, schedules for key tests and deliverables, 
including test plans, were still outstanding. These key tests (formal 
qualification testing, system integration testing, and operational testing and 
evaluation) are incremental tests that the Coast Guard is planning to 
perform before reaching initial operating capability. We also determined 
that the Coast Guard has developed key documentation used for managing 
system requirements and that the Coast Guard has a program in place for 
identifying, prioritizing, and minimizing risks. 



RGCOmmGndcltionS ^° m itigate Rescue 21 risks and ensure that adequate testing occurs and all 

requirements are fulfilled so that the deployed system will work as 
specified, we are recommending that the Secretary of Homeland Security 
direct the Commandant of the United States Coast Guard to 

• establish a new schedule for critical testing phases and initial operating 
capability and 

• ensure that milestones are established for completing test plans for 
formal qualification testing, system integration testing, and operational 
testing and evaluation and that test plans address all requirements of the 
system. 



In providing oral comments on a draft of this report, Coast Guard officials, 
including the Coast Guard's Rescue 21 Project Manager, stated that they 
generally agreed with our findings and recommendations. Coast Guard 
officials also stated that the Coast Guard is actively working with General 
Dynamics to jointly develop a new schedule that considers all the risk 
factors identified in this report. In addition, Coast Guard officials provided 
technical corrections that we incorporated in this report, where 
appropriate. 



As we agreed with your staff, unless you publicly announce the contents of 
this report earlier, we plan no further distribution of it until 30 days from 
the date of this letter. At that time, we will send copies to the Secretary of 
Homeland Security, the Commandant of the United States Coast Guard, 
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and other interested parties. Copies will be made available to others upon 
request. In addition, the report will be available at no charge on the GAO 
Web site at http://www.gao.gov. 

If you have any questions about this report, please contact me at (202) 512- 
9286 or by e-mail at pownerd@gao.gov. Sophia Harrison, Richard Hung, 
David Noone, Colleen Phillips, Karl Seifert, and Eric Winter were major 
contributors to this report. 




David A. Powner 

Director (Acting), Information Technology 
Management Issues 
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The Coast Guard's Rescue 21 Acquisition: An 
Update 



k GAP 

Accountability * Integrity * Reliability 



The Coast Guard's Rescue 21 
Acquisition: An Update 

August 13, 2003 




1 



Page 4 



GAO-03-1111 Coast Guard's Rescue 21 Faces Challenges 



Appendix I 

The Coast Guard's Rescue 21 Acquisition: An 
Update 
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Briefing Outline 


• Introduction 




• Objectives, Scope, and Methodology 




• Results in Brief 




• Rescue 21 Background 




• Status and Plans 




• Key Risk Areas 




• Conclusions 




• Recommendations 
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Appendix I 
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Introduction 



Search and rescue is one of the Coast Guard's oldest missions and one of its 
highest priorities.* The search and rescue mission involves minimizing the 
loss of life, injury, and property damage by aiding people and boats in 
distress. 



The National Distress and Response System (NDRS) is a significant 
component of the Coast Guard's search and rescue program. NDRS is a 
short-range communication network used to communicate over U.S. Coastal 
waters and inland waterways. NDRS allows Coast Guard officers to monitor 
the radio distress frequency and to coordinate search and rescue missions in 
response to mariner distress calls. 

Coast Guard officials have previously reported that the 30-year-old NDRS has 
several deficiencies and is difficult to maintain. Therefore, the Coast Guard 
contracted with General Dynamics Decision Systems (General Dynamics) to 
develop and implement a modernized NDRS, called Rescue 21 . 



*14U.S.C. §90;6U.S.C. §468. 
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Update 
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Objectives, Scope, and Methodology 

Objectives 

• Identify the status and plans of the Coast Guard's acquisition of Rescue 21 . 

• Identify the technical and programmatic risks associated with Rescue 21 . 
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Objectives, Scope, and Methodology (cont'd) 



Scope and Methodology 

To identify the status and plans for acquiring Rescue 21 , we analyzed the 
Rescue 21 acquisition strategy and cost and schedule estimates. We also 
compared original Rescue 21 plans with current strategies. 

To identify the technical and programmatic risks associated with the Rescue 
21 acquisition, we reviewed the Coast Guard's acquisition plans and policies. 
Specifically, we reviewed 

• test management plans, including the test and evaluation master plan 
and formal qualification test plan; 

• requirements management plans, including the mission needs 
statement, operational requirements document, and contract 
performance specification; and 

• risk management plans, including risk watch list and risk mitigation 
strategies. 
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Objectives, Scope, and Methodology (cont'd) 



We also evaluated the Coast Guard's policies for managing Rescue 21 risks, 
requirements, and testing by comparing them to industry best practices and 
Coast Guard policies. In addition, we interviewed program managers and 
contract officials. 



We performed our work at the United States Coast Guard headquarters in 
Washington D.C.; the Coast Guard group site in Chincoteague, Va.; and 
General Dynamics in Scottsdale, Ariz. We conducted our work from 
November 2002 through June 2003, in accordance with generally accepted 
government auditing standards. 
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Results in Brief 



Rescue 21 Status and Plans 



• The original Rescue 21 schedule for reaching initial operating 
capability by September 2003 has been postponed and the Coast 
Guard has not yet finalized a new schedule. 



Rescue 21 Technical and programmatic risks 



• Test management - Effective test management ensures that system 
functions meet their specified requirements. Scheduled end dates for 
formal qualification testing, system integration testing, and operational 
testing and evaluation are still being determined, and key deliverables 
are still outstanding, including test plans. The Coast Guard decided to 
postpone these tests and IOC because of delays in development and 
the resulting risks associated with compressing and overlapping key 
tests. 
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Results in Brief (cont'd) 



Rescue 21 Technical and programmatic risks (cont'd) 

• Requirements management - Effective requirements management 
ensures that the minimum functions and performance levels needed to 
satisfy user needs are met. The Coast Guard has developed key 
documentation used for managing requirements. 

• Risk management - Effective risk management typically includes 
identifying, prioritizing, resolving, and monitoring project risks. The 
Coast Guard's plans for identifying, prioritizing, and minimizing risks 
are in place. 
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Background: The Existing NDRS 



NDRS is a significant component of the Coast Guard's current search and 
rescue program. This system 

• is the Coast Guard's primary short-range communication network, with 
a range of about 20 nautical miles; 

• provides communications for command and control missions, such as 
maritime safety, maritime law enforcement, national security, and 
marine environmental protection; and 

• is composed of VHF-FM radios, communication towers, and 
communication centers. 
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Background: The Existing NDRS (cont'd) 



Much of the existing system was installed in the 1970's, making many of the 
system's components expensive to maintain and difficult to upgrade. In 
addition, the Coast Guard has previously reported that the existing NDRS has 
several other critical deficiencies: 

• numerous gaps in the coverage of communication, affecting 14 
percent of Coast Guard's total area of responsibility; in these areas, 
the Coast Guard cannot hear calls from mariners in distress; 

• limited direction-finding capabilities and no digital selective calling 
capabilities;* 

• no effective way to track Coast Guard assets; 

• limited interoperability with other federal and state communication 
systems; and 

• no means for secure/protected communication. 



*A digital selective calling radio has the ability to send a mayday signal that identifies the vessel and when 
connected to a Global Positioning System, sends the vessel's location. 1 
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Background: Rescue 21 



In September 2002, the Coast Guard awarded a contract to General 
Dynamics for developing and implementing a modernized NDRS, called 
Rescue 21 . The contract and original schedule call for the following: 

• two initial Coast Guard locations to be operating with full functionality, 
scheduled for September 2003, referred to as achieving initial 
operating capability (IOC), and 

• continuing deployment to additional locations through 2006. 



Rescue 21 is to be a short-range communication system with a range of about 
20 nautical miles. The system is to include VHF-FM radios, communication 
towers, and hardware and software at the communication centers. Rescue 
21 's primary functions are to provide the Coast Guard with communication for 

• maritime search-and-rescue functions, such as monitoring distress 
calls from boaters and coordinating the response or rescue, and 

• command and control missions. 
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Background: Rescue 21 (cont'd) 



According to the Coast Guard's contract with General Dynamics, the Rescue 
21 system is to: 

• limit the number of communication coverage gaps in the United States 
to less than 2 percent; 

• use direction finding and digital selective calling to locate boaters; 

• allow the Coast Guard to track its mobile assets; 

• meet interoperability standards to allow communication with other 
federal and state systems; 

• allow secure/protected communication of sensitive information; and 

• archive voice and data communications and have them instantly 
accessible. 
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Status and Plans 



Rescue 21 is currently under development. As of June 2003, the Coast 
Guard's testing and schedule for reaching initial operational capability (IOC) 
was as follows: 



Contract 
awarded 



9/24/02 



I 



FQT* 



8/15/03 



SIT* 



9/2/03 



OT&E* 
IOC 



9/30/03 




2002 



2003 



2004 



2005 



Fully 
operational 

9/06 



2006 



Source: Coast Guard data, GAO analysis. 



The Coast Guard has received funding of $182.4 million for the Rescue 21 
acquisition through fiscal year 2003, and the projected funding through fiscal 
year 2007 is $569.2 million. 

*Formal qualification testing (FQT), system integration testing (SIT), and operational testing and evaluation (OT&E) 
are incremental tests the Coast Guard is planning to perform before reaching IOC. 
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Status and Plans (cont'd) 



In July 2003, the Coast Guard delayed IOC from the original September 30, 
2003, date to a January to March 2004 timeframe. 

According to agency officials and test documents, the causes for delaying IOC 
and preceding test were as follows: 

• General Dynamics had taken longer than expected to obtain 
developers and subcontractors for Rescue 21 , 

• the development of the system software continues to take longer than 
planned. 

Since postponing IOC, the Coast Guard has not developed a schedule for 
formal qualification testing, system integration testing, operational testing and 
evaluation, or IOC. 
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Key Risk Areas: Test Management 



Test management is used to ensure that system functions meet their specified 
requirements. According to leading information technology organizations*, to 
be effective, software testing practices should be planned and conducted in a 
structured and disciplined fashion. Typically, this involves testing increasingly 
larger increments of a system until the complete system is tested and 
accepted and resolving critical problems before moving to the next phase of 
testing. 



*U.S. General Accounting Office Year 2000 Computing Crisis: A Testing Guide (GAO/AIMD-1 0.1 .21 , Washington, 
D.C.: November 1998). 15 
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Key Risk Areas: Test Management (cont'd) 




Rescue 21 is planned to go through the following stages of testing before 
achieving IOC: 






formal qualification 
testing (FQT) 


— ► 


system integration 
testing (SIT) 


— ► 


operational testing and 
evaluation (OT&E) 


— ► 


initial operating 
capability (IOC) 
declared 




•performed by the 
contractor and witnessed 
by the Coast Guard 

•demonstrates that the 
system meets the 
contract performance 
specifications* 

•takes place in a simulated 
environment located at 
the contractor's facility 


•performed by the 
contractor and witnessed 
by the Coast Guard 

•includes system-level 
testing that cannot be fully 
performed during FQT 

•the contractor installs a 
fully functional system at 
two locations to validate to 
the government that 
installation and 
performance meet the 
performance specifications 


•performed by the Coast 
Guard 

•ensures that the installed 
system satisfies the 
contract performance 
requirements and that 
the acquisition program 
is ready to deploy the 
system at other Coast 
Guard locations 


►the system is to be 
operational at two 
locations 




*The contract performance specifications define system level requirements for communications as well as . fi 
information and data processing. 
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Key Risk Areas: Test Management (cont'd) 



Since early 2003, the Coast Guard began postponing formal qualification 
testing and subsequent testing for Rescue 21 . In order for the Coast Guard 
and General Dynamics to meet scheduled end dates, they planned to 
compress and overlap testing schedules. Specifically, 

• formal qualification testing and system integration testing were delayed 
by 6 and 4 months, respectively; 

• the Coast Guard had originally scheduled 2 months to perform formal 
qualification testing, but was planning less than a month; and 

• formal qualification testing and system integration testing were 
planned to be performed in sequence, but were scheduled 
concurrently. 

The graphic on the following slide depicts Rescue 21 's schedule at various 
dates and demonstrates delays and compression of the timing of key tests 
through June 2003. 
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Key Risk Areas: Test Management (cont'd) 



Key Testing Dates Through June 2003 



Formal 

Qualification 

Testing 

System 

Integration 

Testing 

Operational 
Testing and 
Evaluation 



Initial Operating Capability 




January February March 



June July 
2003 



August September October November December 



J Estimates as of October 2002 
| Estimates as of April 2003 
■ Estimates as of June 2003 



Source: Coast Guard data, GAO analysis. 
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Key Risk Areas: Test Management (cont'd) 



Schedule delays, test compression, and testing overlap increase the risk that 

• all requirements will not be tested during formal qualification testing, 
system integration testing, and operational testing and evaluation 
because of the lack of time, and 

• system anomalies that could be found in one testing phase could carry 
over to another testing phase or may not be fully resolved before the 
next testing cycle begins. 

We raised these testing concerns to the Coast Guard in April 2003 and later 
discussed whether these concerns could increase the likelihood that the 
Coast Guard would not be able to test the full functionality of the system and 
deploy the system in the initial sites by September 2003 as was originally 
planned. 
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Key Risk Areas: Test Management (cont'd) 



Due to the previously stated delays in development and resulting risks 
associated with compressing and overlapping key tests, the Coast Guard 
decided to postpone IOC. 

In addition, key actions remain incomplete. The test plans for formal 
qualification testing, system integration testing, and operational testing and 
evaluation are incomplete, and no scheduled completion dates exist. 
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Key Risk Areas: Requirements Management 



System requirements define the minimum functions and performance levels 
needed to satisfy user needs. According to leading industry experts an 
effective requirements management process should establish and maintain a 
common agreement among the project team, including the end user, and 
supplier team.* The mismanagement of requirements can result in an 
unwanted change in a project's scope or a system that does not meet user 
expectations. 



'Software Acquisition Capability Maturity Model Version 1 .03, March 2002. 2-j 
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Key Risk Areas: Requirements Management 
(cont'd) 



The Coast Guard has requirements management practices in place. 
Specifically, it developed the following requirements documents: 

• Mission Needs Statement 

• Operational Requirements 

• Work Breakdown Structure 

• Contract Performance Specification 

Coast Guard officials reported that Rescue 21 requirements have not 
changed as a result of the Coast Guard's moving from the Department of 
Transportation to the Department of Homeland Security. 
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Key Risk Areas: Risk Management 



According to leading management practices, risk management is a key 
component of a sound system development approach. An effective risk 
management approach typically includes identifying, prioritizing, resolving, 
and monitoring project risks. In support of this approach, the Coast Guard's 
risk management plan calls for 

• assigning a severity rating (high, medium, or low) to risks that bear 
particular attention and placing these risks on a "risk watch list;" 

• prioritizing these risks; 

• planning a response or strategy for each risk on the risk watch list, and 
drafting a detailed response plan; and 

• reviewing and evaluating all risks on the risk watch list during monthly 
management meetings. 
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Key Risk Areas: Risk Management (cont'd) 



The Coast Guard is managing risks with Rescue 21 by 

• developing and monitoring a Rescue 21 risk watch list, 

• prioritizing and assigning a severity rating for each risk on the watch 
list, 

• creating a risk management team that meets once every 4 months, 
and 

• developing a risk mitigation strategy for each risk. 
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Key Risk Areas: Risk Management (cont'd) 



High risks identified by the Coast Guard include: 

• software development may delay the schedule, and 

• acquiring antenna sites may be affected by environmental concerns and 
National Environmental Protection Act requirements, which may delay 
the schedule. 

Medium risks identified by the Coast Guard include: 

• Rescue 21 operating expenses are uncertain, and 

• the performance specification and the statement of work could be 
misinterpreted, which could have a negative impact on the technical 
performance of Rescue 21 . 

Coast Guard plans for identifying, prioritizing, and minimizing risks are in place. 



25 



Page 28 



GAO-03-1111 Coast Guard's Rescue 21 Faces Challenges 



Appendix I 

The Coast Guard's Rescue 21 Acquisition: An 
Update 



k GAP 

Accountability * Integrity * Reliability 



Conclusions 



Development and testing of key Rescue 21 components have been delayed, 
and the Coast Guard has not yet established new schedules for key tests or 
for initial operating capability. In addition, key deliverables, such as detailed 
test procedures used to perform key tests, have not been completed. 
Although the Coast Guard has developed key documentation used for 
managing system requirements, it is unknown whether all Rescue 21 
requirements will be fulfilled until detailed testing procedures are completed 
and executed. 
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Recommendations 



To mitigate Rescue 21 risks and to ensure that adequate testing occurs and 
all requirements are fulfilled so that the deployed system will work as 
specified, we are recommending that the Secretary of the Department of 
Homeland Security direct the Commandant of the United States Coast Guard 
to 

• establish a new schedule for critical testing phases and initial 
operating capability; 

• ensure that milestones are established for completing test plans for 
formal qualification testing, system integration testing, and operational 
testing and evaluation and that test plans address all requirements of 
the system. 

(310443) 
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